TickTick CLI (ttg)

Manage TickTick tasks and projects via the `ttg` CLI (github.com/dhruvkelawala/ticktick-go). Full CRUD, checklists/subtasks with progress display, reminders,...

This skill appears to be a legitimate wrapper around the public ticktick-go CLI, but there are two red flags to consider before installing or running any automated install: (1) SKILL.md includes a git clone && make install script (which will execute code from the remote repo on your machine) even though the registry metadata lists no install spec — verify and prefer to install ttg yourself manually after inspecting the repo and Makefile; (2) the skill asks you to create ~/.config/ttg/config.json with client_id and client_secret but the skill metadata does not declare these credentials or config paths — treat those values as sensitive, keep them local, and don't paste them into any remote UI you don't trust. Actionable steps: review the GitHub repository and Makefile for the install steps you would run; manually run ttg auth/login in your browser (instead of an automated install) to obtain tokens; only install or grant credentials if you trust the upstream repo and the skill author, and ask the publisher to correct the metadata so required credentials/config paths are declared explicitly.

Type: OpenClaw Skill Name: ticktick-go Version: 1.1.1 The skill bundle's installation script in `SKILL.md` performs a `git clone` from a third-party repository (`github.com/dhruvkelawala/ticktick-go`) followed by `make install`. This represents an unverified remote code execution risk and a supply chain vulnerability, as the installation process fetches and executes code that is not pinned to a specific commit or checksum. While this behavior is consistent with the stated goal of installing the `ttg` CLI, it allows for potential compromise if the remote repository is altered.